Unanswered
While it is possible to get user information from the session id. I would reccommend passing user_id instead and then using the User DbObject: https://docs.q2developer.com/api_references/q2_sdk/db/db_objects/user.html
47 Views
0
Answers
4 years ago
4 years ago
Thanks Trey - so instead of storing the session id in memcache like the diagram suggests, we should stored the user id instead? I can see how that makes it easier and since the user id doesn't get passed outside the q2 environment (via cookie) then no security concerns. We'll give it a try!
— Chris Janes 4 years agoThere is reason to store the session to make sure the session hasn't expired or isn't a new session. I think that is the reason we did session_id in the docs. Since you seem to have your own token for security it makes sense to just pass the user_id instead. You can always pass both along.
— Trey Teter 4 years agoWe've have successfully stored the user_id in Q2 cache under a one time use token, set the token in the cookie and then looked up the user using the token when we get the response back from our Congito instance. Since this exchange of information is quick, unless the session expires within this very narrow window, this should work just fine for us. Thanks for the suggestion.
— Chris Janes 4 years agoI would recommend handling the session expiring in a smooth manner. Glad I could help.
— Trey Teter 4 years ago